* Daniel P. Berrange (berrange redhat com) wrote:
> On Thu, Jul 23, 2009 at 11:35:17AM -0700, Chris Wright wrote:
> > * Mark McLoughlin (markmc redhat com) wrote:
> > > I'd suggest /dev/hugepages as the default - /hugetlbfs has an seriously
> > > unstandard whiff about it
> >
> > What about /var/lib/libvirt/qemu/hugetlb and having the whole thing under
> > libvirt's control? It can allow for better security I think.
>
> Does hugetlbfs support extended attributes ? If so, the sVirt will
> automatically ensure isolation of each VM's backing file. If it
> doesn't supported extended attrs, then using hugetlbs at all would
> seem to blow a huge hole in our security model ...
You should be able to specify a per mount point security context.
There is no xattr support for hugetlbfs.
thanks,
-chris